新发现的 Zenbleed 漏洞（CVE-2023-20593）影响所有 AMD Zen2 处理器。
不幸的是，AMD 要到 2023 年 11 月或 12 月才会为其许多处理器提供微码更新。
在此期间如何保持安全？
幸运的是，存在一种软件规避方案。
虽然在 Linux 上应用软件规避方案只需一行命令，但在 Windows 上情况更为复杂。
要应用软件规避方案，需要在 MSR CPU 寄存器中设置一个特定的位（chicken bit DE_CFG[9]）。
正如 Travis Ormandy 指出的，以下命令可用于在 Linux 上避免 Zenbleed：
# wrmsr -a 0xc0011029 $(($(rdmsr -c 0xc0011029) | (1<<9)))
在 Windows 下，设置 MSR 寄存器更加困难。
只有内核级驱动程序才允许写入 MSR 寄存器。
此外，要加载内核级驱动程序，它必须经过签名。
这就是我们决定使用 OpenLibSys.org 现有的 WinRing0 驱动程序的原因。
我们编写了一个 PowerShell 脚本，加载 WinRing0，向驱动程序发送适当的 MSR 写入请求，然后立即卸载 WinRing0 驱动程序。
目前，我们的 PowerShell 脚本仅在禁用 Hyper-V 时有效。
我们的 PowerShell 脚本托管在此：https://github.com/sbaresearch/stop-zenbleed-win
请注意，PowerShell 脚本确实附带一些注意事项。
在使用脚本之前，请阅读“注意事项”部分，并针对您的特定环境进行风险评估。
Stop-Zenbleed.ps1NT AUTHORITY\SYSTEM 权限。PS C:\stop-zenbleed-win> powershell -ExecutionPolicy RemoteSigned .\Stop-Zenbleed.ps1
[>] Installing driver...
[SC] CreateService SUCCESS
[>] Starting driver...
SERVICE_NAME: WinRing0_1_2_0
TYPE : 1 KERNEL_DRIVER
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :
[>] Opening driver...
[+] Driver access OK, handle: 2456
[>] Try 1 to apply fix on processor 1
[+] Fix is applied on processor 1 (MSR 0xC0011029=0x300C310E08202)
[+] Fix is applied on processor 2 (MSR 0xC0011029=0x300C310E08203)
[>] Try 1 to apply fix on processor 3
[+] Fix is applied on processor 3 (MSR 0xC0011029=0x3004310E08202)
[+] Fix is applied on processor 4 (MSR 0xC0011029=0x300C310E08203)
[>] Try 1 to apply fix on processor 5
[+] Fix is applied on processor 5 (MSR 0xC0011029=0x300C310E08202)
[+] Fix is applied on processor 6 (MSR 0xC0011029=0x300C310E08203)
[>] Try 1 to apply fix on processor 7
[+] Fix is applied on processor 7 (MSR 0xC0011029=0x300C310E08202)
[+] Fix is applied on processor 8 (MSR 0xC0011029=0x300C310E08203)
[>] Try 1 to apply fix on processor 9
[+] Fix is applied on processor 9 (MSR 0xC0011029=0x300C310E08202)
[+] Fix is applied on processor 10 (MSR 0xC0011029=0x300C310E08203)
[>] Try 1 to apply fix on processor 11
[+] Fix is applied on processor 11 (MSR 0xC0011029=0x300C310E08202)
[+] Fix is applied on processor 12 (MSR 0xC0011029=0x300C310E08203)
[>] Try 1 to apply fix on processor 13
[+] Fix is applied on processor 13 (MSR 0xC0011029=0x300C310E08202)
[+] Fix is applied on processor 14 (MSR 0xC0011029=0x300C310E08203)
[>] Try 1 to apply fix on processor 15
[+] Fix is applied on processor 15 (MSR 0xC0011029=0x300C310E08202)
[+] Fix is applied on processor 16 (MSR 0xC0011029=0x300C310E08203)
[>] Closing driver...
[>] Stopping driver...
SERVICE_NAME: WinRing0_1_2_0
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
[>] Uninstalling driver...
[SC] DeleteService SUCCESS
执行我们的 PowerShell 脚本后，POC 利用程序应该不再产生任何输出。
Stop-Zenbleed.ps1 根据 GNU GPL v3.0 许可证提供：LICENSE